CVE-2026-122316
Received Received - Intake

Kyverno Missing Authorization in Mutate-Existing Processor

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: VulnCheck

Description
Kyverno from 1.17.0 before 1.19.2 contains a missing authorization vulnerability in the mutate-existing background processor that allows namespaced tenants to modify resources outside their namespace. Attackers can create a NamespacedMutatingPolicy targeting Namespace objects or victim-namespace resources via CEL expressions, making the background-controller ServiceAccount strip Pod Security labels cluster-wide.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-122316
EUVD
EUVD-2026-117227

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kyverno kyverno 1.17.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Kyverno (versions 1.17.0 to 1.19.1) allows namespaced tenants to modify resources outside their namespace by creating a NamespacedMutatingPolicy targeting Namespace objects or other namespaces using CEL expressions. The background-controller ServiceAccount can strip Pod Security labels cluster-wide due to missing authorization checks in the mutate-existing background processor.

Detection Guidance

Check Kyverno version with kubectl get deployment kyverno -n kyverno -o jsonpath='{.spec.template.spec.containers[0].image}' to see if it is below 1.19.2. Inspect NamespacedMutatingPolicy resources for suspicious CEL expressions targeting cross-namespace resources or Namespace objects. Review logs of the background-controller pod for unauthorized mutations or cluster-wide label stripping.

Impact Analysis

An attacker with RBAC permissions to create NamespacedMutatingPolicies can modify cluster-scoped resources or resources in other namespaces, leading to high integrity loss. This includes overwriting resources across the cluster using Kyverno's privileged ServiceAccount, potentially disrupting Kubernetes operations and security controls.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized modifications to resources, potentially exposing sensitive data or disrupting security controls. GDPR and HIPAA require strict access controls and data integrity; this flaw undermines those requirements by enabling cross-namespace resource tampering.

Mitigation Strategies

Upgrade Kyverno to version 1.19.2 or later immediately. Audit existing NamespacedMutatingPolicy resources and remove any with CEL expressions targeting cross-namespace resources. Restrict RBAC permissions to prevent untrusted users from creating NamespacedMutatingPolicies. Monitor cluster resources for unauthorized changes or label modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-122316. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...